# wireshark-mcp

Connects tshark to your assistant for deep packet capture examination. Ask questions about .pcap files and detect anomalies without leaving chat.

- MCP server · `type=mcp` · Claude Code, Codex, Cursor, GitHub Copilot, Windsurf (Devin Desktop), Cline, Zed, Gemini CLI · ★ 353
- Author: bx33661
- License: MIT · policy=link-only · description only; the file stays with the author
- Source: https://github.com/bx33661/Wireshark-MCP
- Updated: 2026-10-24
- HTML: https://affpapa.org/en/nevibecode/mcp/wireshark-mcp

## What it does

This server introduces 54 analysis tools on top of command-line `tshark`. An assistant can inspect raw packets, track conversations, check credential leaks, and flag DNS tunneling. A single protocol dispatcher automatically maps query filters across 25 protocols like MQTT and TLS, avoiding syntax guessing mistakes.

System dependencies are strict. You must have Python 3.10 or newer, alongside Wireshark with `tshark` configured inside your system `PATH`. Auxiliary binaries such as `editcap` or `dumpcap` are recognized automatically when present. Without an installed Wireshark binary, the server cannot execute any inspections.

The default tool definitions add around 23 KB to every model request prompt. If this context footprint feels heavy, selecting alternative profiles limits the exposed surface.

## Requirements
- Needs: Python and uv (commands run via uvx)

## Install

### Claude Code (native platform)

**Platform CLI**
```bash
claude mcp add wireshark-mcp -- uvx wireshark-mcp
```
uvx runs the command named after the package; if the README names another one, use uvx --from wireshark-mcp <command>

### Codex

**Platform CLI**
```bash
codex mcp add wireshark-mcp -- uvx wireshark-mcp
```
uvx runs the command named after the package; if the README names another one, use uvx --from wireshark-mcp <command>

### Cursor

**Config file**
File `.cursor/mcp.json`:
```json
{
    "mcpServers": {
        "wireshark-mcp": {
            "command": "uvx",
            "args": [
                "wireshark-mcp"
            ]
        }
    }
}
```
uvx runs the command named after the package; if the README names another one, use uvx --from wireshark-mcp <command>

### GitHub Copilot

**Config file**
File `.vscode/mcp.json`:
```json
{
    "servers": {
        "wireshark-mcp": {
            "type": "stdio",
            "command": "uvx",
            "args": [
                "wireshark-mcp"
            ]
        }
    }
}
```
uvx runs the command named after the package; if the README names another one, use uvx --from wireshark-mcp <command>

### Gemini CLI

**Platform CLI**
```bash
gemini mcp add wireshark-mcp uvx wireshark-mcp
```
uvx runs the command named after the package; if the README names another one, use uvx --from wireshark-mcp <command>

## When to use it
- investigate suspicious DNS queries and potential data tunnels
- inspect HTTP payloads and extract captured artifacts
- spot port scans and plaintext credential transfers
- generate traffic summaries and endpoint communication graphs

## Example prompts
- Inspect `dump.pcap` using `wireshark_open_file` and highlight abnormal flows
- Extract all DNS requests from the capture and check for tunneling
- Summarize conversation endpoints and check for plaintext passwords

## Similar
- [REA](https://affpapa.org/en/nevibecode/mcp/rea.md) — MCP server · ★ 386989
- [World Monitor](https://affpapa.org/en/nevibecode/mcp/world-monitor.md) — MCP server · ★ 89408
- [mcp](https://affpapa.org/en/nevibecode/mcp/kubeshark-mcp.md) — MCP server · ★ 12109
- [Robin: AI-Powered Dark Web OSINT](https://affpapa.org/en/nevibecode/mcp/robin-ai-powered-dark-web-osint.md) — MCP server · ★ 7658
- [jshookmcp](https://affpapa.org/en/nevibecode/mcp/jshookmcp.md) — MCP server · ★ 2061
- [OpenOSINT](https://affpapa.org/en/nevibecode/mcp/openosint.md) — MCP server · ★ 1802

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md